Provided by: 

Mat Whited, CPA

Identity theft has increased exponentially over the past few years, and is widely considered the fastest growing crime, highlighted recently by breaches at Experian and Target. A 2017 Identity Fraud Study, by Javelin Strategy & Research, found that 15.4 million Americans had approximately $16 billion stolen in identity fraud related cases in 2016. Jamie Shea, NATO Director of Policy Planning, quoted in 2014, "One hundred twenty countries currently have or are developing offensive cyber-attack capabilities, which is now viewed as the fifth dimension of warfare after space, sea, land and air..."

The information that hackers are trying to obtain is Personally Identifiable Information ("PII"), which is information that, when disclosed, could result in harm to the individual whose privacy had been breached. Basically, information that someone could make money off of is stolen and/or sold. Examples of PII include: Name & Address, Social Security Number, Date and Place of Birth, Biometrics, Income, Account Numbers, etc. The cost of identity theft is obviously extremely harmful to an individual, but it can be just as harmful to a company or business where the breach occurred. Per the National Small Business Association, the average small business data breach costs approximately $32,000. The average per record cost of a breach is $214. Currently, the most targeted industries include: Healthcare, Financial/Accounting and Retail.

The current security threats include the following:

Malware - Software that is intended to damage or disable computers and systems in a variety of forms including: computer viruses, worms, Trojan horses, spyware, adware, scripts, etc. Malware is usually delivered through an email or a website. It is estimated that 1 million pieces of new Malware are created per day.

Ransomware - A type of Malware that encrypts your data and demands a ransom payment in order for your computer or system to be restored. There is no guarantee that the information will be restored if the ransom is paid. It is estimated that 4,000 attacks occurred daily in 2016.

Man-in-the-Middle - This method typically occurs in a public location where an imposter Wi-Fi router is set up to capture data of unsuspecting users. Example: a user is in a coffee shop and connects to their free Wi-Fi. The Wi-Fi is named similar to the coffee shop name; however, it is not the correct Wi-Fi router. All of the information you submit online is then captured by the imposter Wi-Fi router, but the user does not know as they are still able to access the Internet.

Social Engineering - This type of threat includes email phishing, phone scam, spear phishing (message directly to specific person), and even defrauding an online account holder of financial information by posing as a business or IRS.

In order to reduce your risk, the IRS recommends the following tips:

• Always use security software with firewall and anti-virus protections. Use strong passwords.
• Learn to recognize and avoid phishing emails, threatening calls and texts from thieves posing as legitimate organizations such as your bank, credit card companies and even the IRS.
• Do not click on links or download attachments from unknown or suspicious emails.
• Protect your personal data. Don't routinely carry your Social Security card and make sure your tax records are secure.

See Publication 4524, Security Awareness for Taxpayers, for additional tips. Additionally, a small business should consider developing and implementing a Cyber Risk Management Program based on security risk analysis.

Read More